kibi-cli 2.14.0 → 2.16.0

package/src/public/operations/check-policy-rules.ts

@@ -0,0 +1,462 @@
+/*
+ Kibi — repo-local, per-branch, queryable long-term memory for software projects
+ Copyright (C) 2026 Piotr Franczyk
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program.  If not, see <https://www.gnu.org/licenses/>.
+*/
+
+import * as fs from "node:fs";
+import {
+  basename,
+  dirname,
+  extname,
+  isAbsolute,
+  join,
+  posix,
+  relative,
+} from "node:path";
+import ignore from "ignore";
+import type {
+  CheckPolicyMarkerRule,
+  CheckPolicyOwnershipRule,
+} from "kibi-plugin-sdk";
+
+import {
+  type ActiveCheckPolicy,
+  type CheckPolicyLoadError,
+  readActiveCheckPolicies,
+} from "../../plugins/check-policies.js";
+import { parseListOfLists, parsePrologValue } from "../../prolog/codec.js";
+import type { Violation } from "../../utils/rule-registry.js";
+import { loadEntitiesPaged } from "./discovery-entities.js";
+import type { PrologPort } from "./runtime-types.js";
+
+/** Symbols in a policy's file set must implement a qualifying requirement. */
+// implements REQ-capability-check-policy
+export const POLICY_OWNERSHIP_RULE = "policy-ownership";
+/** Files implementing a pattern must keep the pattern's declared markers. */
+// implements REQ-capability-check-policy
+export const POLICY_MARKERS_RULE = "policy-markers";
+
+const POLICY_RULES = [POLICY_OWNERSHIP_RULE, POLICY_MARKERS_RULE] as const;
+
+// implements REQ-capability-check-policy
+export type PolicySymbol = Readonly<{
+  id: string;
+  title: string;
+  sourceFile: string;
+  tags: readonly string[];
+}>;
+
+// implements REQ-capability-check-policy
+export type PolicyPredicateFact = Readonly<{
+  id: string;
+  name: string;
+  args: readonly string[];
+  polarity: string;
+}>;
+
+// implements REQ-capability-check-policy
+export type CheckPolicyEvaluationInput = Readonly<{
+  policies: readonly ActiveCheckPolicy[];
+  loadErrors: readonly CheckPolicyLoadError[];
+  /** Production symbols (no `executable_for`) that carry a sourceFile. */
+  symbols: readonly PolicySymbol[];
+  /** `[symbol, requirement]` implements edges. */
+  implementsEdges: readonly (readonly [string, string])[];
+  currentRequirements: ReadonlySet<string>;
+  /** `[requirement, fact]` requires_predicate edges. */
+  requiresPredicateEdges: readonly (readonly [string, string])[];
+  predicateFacts: readonly PolicyPredicateFact[];
+  /** Workspace-relative file contents, or undefined when unreadable. */
+  readFile: (path: string) => string | undefined;
+}>;
+
+function toPosix(path: string): string {
+  return path.replaceAll("\\", "/").replace(/^\.\//, "");
+}
+
+/** True for a workspace-relative path that stays inside the workspace. */
+function insideWorkspace(path: string): boolean {
+  return (
+    path !== "" &&
+    !path.startsWith("/") &&
+    !/^[A-Za-z]:\//.test(path) &&
+    path !== ".." &&
+    !path.startsWith("../")
+  );
+}
+
+/**
+ * Workspace-relative POSIX path of a symbol sourceFile, or undefined when it
+ * points outside the workspace. Policies only govern workspace files.
+ */
+// implements REQ-capability-check-policy
+export function workspaceSourcePath(
+  workspaceRoot: string,
+  sourceFile: string,
+): string | undefined {
+  const path = posix.normalize(
+    toPosix(
+      isAbsolute(sourceFile) ? relative(workspaceRoot, sourceFile) : sourceFile,
+    ),
+  );
+  return insideWorkspace(path) ? path : undefined;
+}
+
+function matcher(patterns: readonly string[]): (path: string) => boolean {
+  const matcher = ignore().add([...patterns]);
+  return (path) => {
+    const relative = toPosix(path);
+    // ignore() throws on absolute and ../ paths; neither is in a policy's scope.
+    return insideWorkspace(relative) && matcher.ignores(relative);
+  };
+}
+
+function groupBy<T>(
+  pairs: readonly (readonly [string, T])[],
+): Map<string, T[]> {
+  const grouped = new Map<string, T[]>();
+  for (const [key, value] of pairs) {
+    grouped.set(key, [...(grouped.get(key) ?? []), value]);
+  }
+  return grouped;
+}
+
+/** Asserted predicate names each current requirement is grounded in. */
+function requirementPredicates(
+  input: CheckPolicyEvaluationInput,
+): Map<string, PolicyPredicateFact[]> {
+  const facts = new Map(input.predicateFacts.map((fact) => [fact.id, fact]));
+  const grounded = new Map<string, PolicyPredicateFact[]>();
+  for (const [req, factId] of input.requiresPredicateEdges) {
+    const fact = facts.get(factId);
+    if (!input.currentRequirements.has(req) || fact === undefined) continue;
+    if (fact.polarity !== "assert") continue;
+    grounded.set(req, [...(grounded.get(req) ?? []), fact]);
+  }
+  return grounded;
+}
+
+function ownershipViolations(
+  policy: ActiveCheckPolicy,
+  rule: CheckPolicyOwnershipRule,
+  input: CheckPolicyEvaluationInput,
+  grounded: Map<string, PolicyPredicateFact[]>,
+  owners: Map<string, string[]>,
+): Violation[] {
+  const included = matcher(rule.include);
+  const excluded = matcher(rule.exclude ?? []);
+  const title =
+    rule.symbolTitlePattern !== undefined
+      ? new RegExp(rule.symbolTitlePattern)
+      : undefined;
+  const qualifying = new Set(rule.requirePredicates);
+  const violations: Violation[] = [];
+  for (const symbol of input.symbols) {
+    if (!included(symbol.sourceFile) || excluded(symbol.sourceFile)) continue;
+    if (title !== undefined && !title.test(symbol.title)) continue;
+    if (rule.exemptTag !== undefined && symbol.tags.includes(rule.exemptTag))
+      continue;
+    const requirements = owners.get(symbol.id) ?? [];
+    const owned = requirements.some((req) =>
+      (grounded.get(req) ?? []).some((fact) => qualifying.has(fact.name)),
+    );
+    if (owned) continue;
+    violations.push({
+      rule: POLICY_OWNERSHIP_RULE,
+      entityId: symbol.id,
+      description: `${symbol.id} (${symbol.sourceFile}) is in scope of ${policy.packageName} rule '${rule.id}' but implements no current requirement grounded in ${rule.requirePredicates.join(", ")}`,
+      suggestion: `${rule.description}. Link the symbol with implements to a requirement that carries one of these predicates via requires_predicate, or create that requirement first${rule.exemptTag !== undefined ? `; tag the symbol '${rule.exemptTag}' only when it is intentionally unconstrained` : ""}.`,
+      source: symbol.sourceFile,
+      evidence: {
+        policy: policy.document.id,
+        package: policy.packageName,
+        policyRule: rule.id,
+        requirePredicates: [...rule.requirePredicates],
+        implements: requirements,
+      },
+    });
+  }
+  return violations;
+}
+
+/** Marker text as declared, plus its kebab-case spelling for snake_case atoms. */
+function markerSpellings(marker: string): string[] {
+  return [...new Set([marker, marker.replaceAll("_", "-")])];
+}
+
+function searchedFiles(
+  sourceFile: string,
+  rule: CheckPolicyMarkerRule,
+): string[] {
+  const source = toPosix(sourceFile);
+  const directory = dirname(source);
+  const stem = basename(source, extname(source));
+  const siblings = (rule.siblingExtensions ?? []).map((extension) =>
+    toPosix(join(directory, `${stem}${extension}`)),
+  );
+  return [source, ...siblings.filter((path) => path !== source)];
+}
+
+function markerViolations(
+  policy: ActiveCheckPolicy,
+  rule: CheckPolicyMarkerRule,
+  input: CheckPolicyEvaluationInput,
+  grounded: Map<string, PolicyPredicateFact[]>,
+  owners: Map<string, string[]>,
+): Violation[] {
+  const markersByPattern = new Map<string, string[]>();
+  for (const fact of input.predicateFacts) {
+    if (fact.name !== rule.markerPredicate || fact.polarity !== "assert")
+      continue;
+    const pattern = fact.args[rule.markerPatternArgument];
+    const marker = fact.args[rule.markerArgument];
+    if (pattern === undefined || marker === undefined) continue;
+    markersByPattern.set(pattern, [
+      ...(markersByPattern.get(pattern) ?? []),
+      marker,
+    ]);
+  }
+  const violations: Violation[] = [];
+  // Several symbols in one file (component, props, helpers) share its markers;
+  // report each missing marker once per file and requirement.
+  const reported = new Set<string>();
+  for (const symbol of input.symbols) {
+    for (const req of owners.get(symbol.id) ?? []) {
+      for (const fact of grounded.get(req) ?? []) {
+        if (fact.name !== rule.patternPredicate) continue;
+        const pattern = fact.args[rule.patternArgument];
+        if (pattern === undefined) continue;
+        const files = searchedFiles(symbol.sourceFile, rule);
+        const contents = files
+          .map((path) => input.readFile(path))
+          .filter((content): content is string => content !== undefined);
+        for (const marker of [
+          ...new Set(markersByPattern.get(pattern) ?? []),
+        ]) {
+          const present = markerSpellings(marker).some((spelling) =>
+            contents.some((content) => content.includes(spelling)),
+          );
+          const key = JSON.stringify([files[0], req, marker]);
+          if (present || reported.has(key)) continue;
+          reported.add(key);
+          violations.push({
+            rule: POLICY_MARKERS_RULE,
+            entityId: symbol.id,
+            description: `${symbol.id} implements ${req}, which uses pattern '${pattern}', but none of ${files.join(", ")} contains its marker '${marker}'`,
+            suggestion: `${rule.description}. Restore the pattern in the implementation, or if the design changed on purpose, supersede ${req} with a requirement naming the new pattern.`,
+            source: symbol.sourceFile,
+            evidence: {
+              policy: policy.document.id,
+              package: policy.packageName,
+              policyRule: rule.id,
+              requirement: req,
+              pattern,
+              marker,
+              searchedFiles: files,
+            },
+          });
+        }
+      }
+    }
+  }
+  return violations;
+}
+
+function loadErrorViolations(
+  errors: readonly CheckPolicyLoadError[],
+  rules: ReadonlySet<string>,
+): Violation[] {
+  const rule = POLICY_RULES.find((name) => rules.has(name));
+  if (rule === undefined) return [];
+  return errors.map((error) => ({
+    rule,
+    entityId: error.packageName,
+    description: `Check policy from '${error.packageName}' could not be read: ${error.message}`,
+    suggestion:
+      "Install the activated plugin package in this workspace, or remove its kibi.check-policy.v1 entry from package.json#kibi.plugins. Kibi does not skip an activated policy it cannot read.",
+    evidence: { package: error.packageName },
+  }));
+}
+
+/**
+ * Evaluate active check policies against the KB. Pure: all KB data and file
+ * reads come in through `input`.
+ */
+// implements REQ-capability-check-policy
+export function evaluateCheckPolicies(
+  input: CheckPolicyEvaluationInput,
+  rules: ReadonlySet<string>,
+): Violation[] {
+  const grounded = requirementPredicates(input);
+  const owners = groupBy(
+    input.implementsEdges.filter(([, req]) =>
+      input.currentRequirements.has(req),
+    ),
+  );
+  const violations = loadErrorViolations(input.loadErrors, rules);
+  for (const policy of input.policies) {
+    if (rules.has(POLICY_OWNERSHIP_RULE)) {
+      for (const rule of policy.document.ownership ?? []) {
+        violations.push(
+          ...ownershipViolations(policy, rule, input, grounded, owners),
+        );
+      }
+    }
+    if (rules.has(POLICY_MARKERS_RULE)) {
+      for (const rule of policy.document.markers ?? []) {
+        violations.push(
+          ...markerViolations(policy, rule, input, grounded, owners),
+        );
+      }
+    }
+  }
+  return violations;
+}
+
+async function rows(
+  prolog: Pick<PrologPort, "query">,
+  goal: string,
+  what: string,
+): Promise<string[][]> {
+  const result = await prolog.query(goal);
+  if (!result.success) {
+    throw new Error(
+      `Unable to read ${what} for check policies: ${result.error ?? "query failed"}`,
+    );
+  }
+  return parseListOfLists(result.bindings.Rows ?? "[]");
+}
+
+function atom(value: string | undefined): string {
+  return String(parsePrologValue(value ?? ""));
+}
+
+function stringList(value: unknown): string[] {
+  if (Array.isArray(value)) return value.map(String);
+  if (typeof value === "string" && value !== "") return [value];
+  return [];
+}
+
+function fileReader(
+  workspaceRoot: string,
+): (path: string) => string | undefined {
+  const cache = new Map<string, string | undefined>();
+  return (path) => {
+    if (!insideWorkspace(toPosix(path))) return undefined;
+    if (!cache.has(path)) {
+      try {
+        cache.set(path, fs.readFileSync(join(workspaceRoot, path), "utf8"));
+      } catch {
+        cache.set(path, undefined);
+      }
+    }
+    return cache.get(path);
+  };
+}
+
+/**
+ * Collect policy findings for the selected rules. With no activated check
+ * policy this returns at once, so projects without one pay nothing.
+ */
+// implements REQ-capability-check-policy
+export async function collectCheckPolicyViolations(
+  prolog: Pick<PrologPort, "query">,
+  rules: ReadonlySet<string>,
+  workspaceRoot: string,
+): Promise<Violation[]> {
+  if (!POLICY_RULES.some((rule) => rules.has(rule))) return [];
+  const { policies, errors } = readActiveCheckPolicies(workspaceRoot);
+  if (policies.length === 0) {
+    return loadErrorViolations(errors, rules);
+  }
+  // One Prolog port serves queries in order; read sequentially.
+  const symbolEntities = await loadEntitiesPaged(prolog, "symbol", 200);
+  const testSymbols = new Set(
+    (
+      await rows(
+        prolog,
+        "findall([S], kb:executable_test_symbol(S), Rows0), sort(Rows0, Rows)",
+        "executable test symbols",
+      )
+    ).map(([id]) => atom(id)),
+  );
+  const implementsEdges = (
+    await rows(
+      prolog,
+      "findall([S,R], kb_relationship(implements, S, R), Rows)",
+      "implements relationships",
+    )
+  ).map(([from, to]) => [atom(from), atom(to)] as const);
+  const requiresPredicateEdges = (
+    await rows(
+      prolog,
+      "findall([R,F], kb_relationship(requires_predicate, R, F), Rows)",
+      "requires_predicate relationships",
+    )
+  ).map(([from, to]) => [atom(from), atom(to)] as const);
+  const currentRequirements = new Set(
+    (
+      await rows(
+        prolog,
+        "findall([R], kb:current_req(R), Rows)",
+        "current requirements",
+      )
+    ).map(([id]) => atom(id)),
+  );
+  const predicateFacts = (
+    await rows(
+      prolog,
+      "findall([F,Name,Args,Polarity], kb:predicate_fact(F, _, Name, Args, Polarity), Rows)",
+      "predicate facts",
+    )
+  ).map(([id, name, args, polarity]) => ({
+    id: atom(id),
+    name: atom(name),
+    args: stringList(parsePrologValue(args ?? "[]")),
+    polarity: atom(polarity),
+  }));
+
+  const symbols: PolicySymbol[] = symbolEntities.flatMap((entity) => {
+    const id = String(entity.id ?? "");
+    const sourceFile =
+      typeof entity.sourceFile === "string"
+        ? workspaceSourcePath(workspaceRoot, entity.sourceFile)
+        : undefined;
+    if (id === "" || testSymbols.has(id) || sourceFile === undefined) return [];
+    return [
+      {
+        id,
+        title: String(entity.title ?? id),
+        sourceFile,
+        tags: stringList(entity.tags),
+      },
+    ];
+  });
+
+  return evaluateCheckPolicies(
+    {
+      policies,
+      loadErrors: errors,
+      symbols,
+      implementsEdges,
+      currentRequirements,
+      requiresPredicateEdges,
+      predicateFacts,
+      readFile: fileReader(workspaceRoot),
+    },
+    rules,
+  );
+}

package/src/public/operations/contracts.ts

@@ -489,6 +489,7 @@ const BASE_DATA_SCHEMAS: Readonly<
   kb_find_gaps: objectData({
     rows: recordArray,
     count: integerValue,
+    summary: recordValue,
     meta: recordValue,
   }),
   kb_coverage: objectData({
@@ -603,6 +604,11 @@ const BASE_DATA_SCHEMAS: Readonly<
       tldr: stringValue,
       promptBlock: stringValue,
       recommendedActions: recordArray,
+      pluginOffers: {
+        ...recordArray,
+        description:
+          "Optional plugins that fit this workspace and that the project has neither activated nor declined. Ask the operator; on yes install and activate the package, on no add it to package.json kibi.declinedPlugins.",
+      },
       declaredContext: recordValue,
       discoverySummary: recordValue,
       candidates: recordArray,

package/src/public/operations/discovery-executors.ts

@@ -16,10 +16,12 @@ import { rankEntities } from "../../search-ranking.js";
 import type { SearchMatch } from "../../search-ranking.js";
 import { resolveBranchAttachment } from "../../utils/branch-resolver.js";
 import {
+  BRANCH_STORE_NOT_COMPILED,
   type BranchStoreInspection,
   branchStoreReason,
   inspectBranchStore,
   storeLockJournalReason,
+  uncompiledBranchStoreReason,
 } from "../../utils/branch-store.js";
 import {
   loadEntities,
@@ -459,7 +461,17 @@ export async function executeStatus(
       }
     const snapshotEvidence = await readWorkspaceSnapshot(context);
     const existingReasons = payload.staleReasons ?? [];
-    const storeReason = branchStoreReason(store);
+    // implements REQ-cli-status-pre-first-sync
+    // A missing or empty store beside authored sources gets the one reason
+    // whose remediation works (kibi sync); `kibi branch ensure` alone would
+    // leave the store empty.
+    const storeReason =
+      uncompiledBranchStoreReason(
+        context.workspaceRoot,
+        store,
+        attachment.kbBranch,
+      ) ?? branchStoreReason(store);
+    const storeUncompiled = storeReason?.code === BRANCH_STORE_NOT_COMPILED;
     const lockReason = storeLockJournalReason(store.path);
     const compilerReason = compilerFingerprintReason(store.path);
     const engineReason = engineStatus
@@ -495,6 +507,11 @@ export async function executeStatus(
       // Source hashes can all match while the compilation itself is lossy, so
       // a compiler contract change alone makes the store stale.
       ...(compilerReason ? { syncState: "stale", dirty: true } : {}),
+      // An empty store has no stale file to report, yet nothing in it is
+      // current: the authored sources were never compiled.
+      ...(storeUncompiled && store.state === "healthy"
+        ? { syncState: "stale", dirty: true }
+        : {}),
       branchAttachment: attachment,
       branchStore: store,
       ...(engineStatus ? { engineStatus } : {}),
@@ -644,7 +661,7 @@ export async function executeStatus(
       content: [
         {
           type: "text",
-          text: `Branch ${payload.branch} is ${payload.syncState} (snapshot ${payload.snapshotId}, dirty=${payload.dirty}, proofSnapshot=${enrichedPayload.proofSnapshot})`,
+          text: `Branch ${payload.branch} is ${enrichedPayload.syncState} (snapshot ${payload.snapshotId}, dirty=${enrichedPayload.dirty}, proofSnapshot=${enrichedPayload.proofSnapshot})${storeUncompiled ? `. Blocking: ${String(storeReason?.detail)} Run kibi sync.` : ""}`,
         },
       ],
       structuredContent: statusWithPlan,

package/src/public/operations/migration-plan.ts

@@ -1,6 +1,7 @@
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import * as path from "node:path";
+import { BRANCH_STORE_NOT_COMPILED } from "../../utils/branch-store.js";
 import { legacyConfigExists } from "../../utils/config.js";
 import { readKbManifestStatus } from "../../utils/kb-manifest.js";
 import {
@@ -744,8 +745,42 @@ export function buildActionsFromStatus(input: {
     );
   }
 
+  // implements REQ-cli-status-pre-first-sync
+  // A branch store that was never compiled while .kb/ holds authored sources
+  // is fixed only by compiling it: `kibi branch ensure` alone leaves an empty
+  // manifest. The compile step runs after the store exists and after any
+  // schema migration, so it compiles the migrated sources.
+  const uncompiled = (input.staleReasons ?? []).find(
+    (reason) => reason.code === BRANCH_STORE_NOT_COMPILED,
+  );
+  if (uncompiled !== undefined) {
+    actions.push(
+      migrationAction({
+        id: "branch-store-compile",
+        code: BRANCH_STORE_NOT_COMPILED,
+        category: "storage",
+        safety: "automatic",
+        invocation: { kind: "cli", command_argv: ["kibi", "sync"] },
+        affectedFiles: [
+          typeof store?.path === "string" ? store.path : ".kb/branches",
+        ],
+        evidence: { reason: uncompiled },
+        dependsOn: actions
+          .map((action) => action.id)
+          .filter(
+            (id) =>
+              id === "branch-store-ensure" || id === "schema-config-upgrade",
+          ),
+        postconditions: [{ branchStore: "compiled" }],
+        autoApplicable: true,
+      }),
+    );
+  }
+
   for (const reason of input.staleReasons ?? []) {
     const code = typeof reason.code === "string" ? reason.code : "stale_source";
+    // Planned above as an automatic compile step, not a review.
+    if (code === BRANCH_STORE_NOT_COMPILED) continue;
     const file = typeof reason.path === "string" ? reason.path : "";
     actions.push(
       migrationAction({

package/src/public/operations/source-relationship-parity.ts

@@ -160,6 +160,22 @@ function authoredRelationship(
   };
 }
 
+/**
+ * The repair that works for a source-discovery failure. There is no separate
+ * receipt repair tool: a rewrite through kb_upsert republishes a receipt,
+ * and `kibi branch recover` retires receipts of files removed on purpose.
+ */
+// implements REQ-kibi-source-relationship-parity
+function sourceDiscoverySuggestion(message: string): string {
+  if (/Pending source hash drift/.test(message)) {
+    return "A pending-source receipt no longer matches its untracked file. Rewrite that entity with kb_upsert (its current title and status are enough) so the receipt is republished against the file's current bytes, or 'git add' the file to retire the receipt; then rerun kb_check. Do not ignore missing authored inputs.";
+  }
+  if (/Pending source is missing/.test(message)) {
+    return "A pending-source receipt binds an untracked file that no longer exists. If the file was deleted on purpose, run 'kibi branch recover --apply' to rebuild the branch KB from the sources that remain; otherwise restore the file (or rewrite the entity with kb_upsert); then rerun kb_check.";
+  }
+  return "Repair the authored sources named in the message (restore or rewrite the entity with kb_upsert, or run 'kibi branch recover --apply' for sources removed on purpose), then rerun kb_check; do not ignore missing authored inputs.";
+}
+
 // implements REQ-kibi-source-relationship-parity
 export async function collectSourceRelationshipParityViolations(
   workspaceRoot: string,
@@ -179,8 +195,7 @@ export async function collectSourceRelationshipParityViolations(
         rule: "source-relationship-parity",
         entityId: "source-discovery",
         description: `Authored relationship parity could not establish a complete source view: ${message}`,
-        suggestion:
-          "Repair the pending-source receipt through Kibi recovery, then rerun kb_check; do not ignore missing authored inputs.",
+        suggestion: sourceDiscoverySuggestion(message),
         evidence: {
           direction: "source_discovery",
           message,

package/src/public/operations/specs/check-rules.generated.ts

@@ -15,6 +15,7 @@ export const SELECTABLE_RULE_NAMES: readonly string[] = [
   "symbol-traceability",
   "no-dangling-refs",
   "source-relationship-parity",
+  "branch-store-not-compiled",
   "source-path-dangling",
   "no-cycles",
   "required-fields",
@@ -54,9 +55,11 @@ export const SELECTABLE_RULE_NAMES: readonly string[] = [
   "predicate-schema-conformance",
   "entity-context-missing",
   "entity-context-acknowledged",
+  "policy-ownership",
+  "policy-markers",
 ];
 
 // implements REQ-006
 /** Comma-separated "Allowed:" fragment for the kb_check rules description. */
 export const SELECTABLE_RULES_ALLOWED =
-  "must-priority-coverage, symbol-coverage, symbol-traceability, no-dangling-refs, source-relationship-parity, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged";
+  "must-priority-coverage, symbol-coverage, symbol-traceability, no-dangling-refs, source-relationship-parity, branch-store-not-compiled, source-path-dangling, no-cycles, required-fields, deprecated-adr-no-successor, superseded-requirement-open, scenario-feasibility, scenario-feasibility-unknown, exception-claim-keys, numeric-string-value, rule-key-arguments-missing, domain-contradictions, logic-coverage, rule-safety, rule-verifiability, query-plan-safety, req-status-vocabulary, strict-fact-shape, strict-req-fact-pairing, predicate-verifiability, strict-readiness, semantic-completeness, related-requirement-unmodeled, proof-contract-symbols, entity-id-style, domain-redundancy, domain-implication, subject-key-identity, subject-key-shape, ontology-quality, exception-unapproved, exception-approval-self-attested, agent-requirement-unapproved, requirement-rationale-missing, symbol-owner-superseded, adr-unlinked, adr-proposed, predicate-schema-conformance, entity-context-missing, entity-context-acknowledged, policy-ownership, policy-markers";